All Apps and Add-ons

SoS-TA clustered search peer deploy - incorrect scripted input path error

NGRhodes
Explorer

I deployed the SoS-TA package by placing it in on our custer master in /opt/splunk/etc/master-apps directory and deploying from the Web UI.

I noticed the following error after enabling the inputs:

01-08-2015 11:19:08.762 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-sos/bin/ps_sos.sh" /bin/sh: 1: /opt/splunk/etc/apps/TA-sos/bin/ps_sos.sh: not found

The fix
Simply clone the 3 scripted inputs from SoS-TA and recreate the correct path eg:

 /opt/splunk/etc/apps/TA-sos/bin/ps_sos.sh

Becomes:

 /opt/splunk/etc/slave-apps/TA-sos/bin/ps_sos.sh

Have I deployed this incorrectly or is it a bug in the the package deployment mechanism ?

1 Solution

hexx
Splunk Employee
Splunk Employee

This is pretty strange and very unexpected as the S.o.S technology add-on has been specifically validated to work in an indexer cluster environment, deployed from the cluster master just as you described.

Do you maybe have a pre-existing copy of "TA-sos" under $SPLUNK_HOME/etc/apps on the cluster peers? If so, you should remove that version and allow the one under $SPLUNK_HOME/etc/slave-apps to be the only copy of this TA present on the cluster peers.

Don't forget to enable the scripted inputs in $SPLUNK_HOME/etc/master-apps/local/inputs.conf on the Cluster Master before pushing out the TA!

View solution in original post

hexx
Splunk Employee
Splunk Employee

This is pretty strange and very unexpected as the S.o.S technology add-on has been specifically validated to work in an indexer cluster environment, deployed from the cluster master just as you described.

Do you maybe have a pre-existing copy of "TA-sos" under $SPLUNK_HOME/etc/apps on the cluster peers? If so, you should remove that version and allow the one under $SPLUNK_HOME/etc/slave-apps to be the only copy of this TA present on the cluster peers.

Don't forget to enable the scripted inputs in $SPLUNK_HOME/etc/master-apps/local/inputs.conf on the Cluster Master before pushing out the TA!

NGRhodes
Explorer

I did originally copy to the wrong location, looks like there were some leftovers that splunk was picking up 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...